Data, privacy and the information lifecycle

Do we control our information from creation to destruction?

4 leadership pages, 28 governing documents. Can we withstand what hits us?

Information the organization cannot classify, locate, or provably destroy is a liability with no expiry date. Cross-border movement and changing legal boundaries turn quiet data flows into board-level exposure without any system changing at all.

Note

Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.

Leadership

The leadership pages

Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.

Documents

The governing documents

The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.

Privacy Management Programme Chartercharter, Privacy
Legal and Regulatory Compliance Policypolicy, Compliance
Privacy and Data Governance Policypolicy, Privacy
AI Access and Agent Permissions Standardstandard, AI
AI Data Quality and Readiness Validation Standardstandard, AI
AI Security and Risk Standardstandard, AI
Cloud Exit and Data Portability Standardstandard, Supply chain
Data Architecture Standardstandard, Architecture
Data Classification and Handling Standardstandard, Security
Records Retention and Destruction Standardstandard, Governance
Architecture Review Procedureprocedure, Architecture
Backup and Recovery Procedureprocedure, Resilience
Change Management and Configuration Control Procedureprocedure, Operations
Control Testing Procedureprocedure, Compliance
Data Protection and Privacy Breach Response Procedureprocedure, Privacy
Integrated AI and Privacy Assessment Procedureprocedure, AI
Privacy Impact and Cross-Border Transfer Procedureprocedure, Privacy
Supplier Exit and Data Return Procedureprocedure, Supply chain
Training Data Governance Procedureprocedure, AI
AI Board Oversight Guideguide, AI
Assurance Map Registerregister, Risk
Cross-Border Data Flow Registerregister, Privacy
Data Retention Scheduleregister, Governance
Global Regulatory Applicability Registerregister, Compliance
Scenario Risk Catalogueregister, Risk
Audit Evidence Package Templatetemplate, Compliance
Dataset Datasheet Templatetemplate, AI
Privacy Jurisdiction Indexannex, Privacy

Frameworks

Frameworks touched

The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.

Bank of England / PRA SS1/21
BASC
Basel Committee Operational Resilience Principles
Basel Committee Operational Risk Principles
Canada TBS Guide on the Use of Agentic AI (comparator)
Canada Treasury Board Directive on Automated Decision-Making
COBIT
COSO ERM 2017
CSA AICM
CSA CCM
Cybersecurity Law Art. 44 para. 2 and, where the incident also endangers network security, Art. 27 (amended numbering, in force 1 January 2026)
DAMA-DMBOK 2
Data Cards
Data Mesh (Zhamak Dehghani)
Data Protection Act 2018
Datasheets for Datasets
Digital Personal Data Protection Rules 2025
DORA
DPBI
DPDPA 2023
EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1 (adopted 7 July 2021)
EDPB Guidelines 9/2022 (Version 2.0) paragraphs 78 to 80 and Annex B example (i)
EDPB Guidelines 9/2022 on personal data breach notification (Version 2.0) paragraph 118
ENISA Guidelines
ETSI EN 304 223 V2.1.1
ETSI TR 104 128 V1.1.1 (2025-05)
EU AI Act
EU Data Act (Regulation (EU) 2023/2854), Chapter VI: Switching between data processing services
FISMA 2014 (44 U.S.C. 3553 note) for federal agencies
FRC UK Corporate Governance Code
GC Cyber Security Event Management Plan §2.3.1.4 (held text: date modified 2026-05-20, cited at the edition held, currency to be confirmed upstream)
GDPR
IIA Three Lines Model 2020
ISO 15489-1:2016
ISO 19011:2026
ISO 22301:2019
ISO 28000:2022
ISO 2859-1
ISO 31000
ISO 37301:2021
ISO 8000
ISO/IEC 20000-1:2018
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27005:2022
ISO/IEC 27035-1:2023
ISO/IEC 27035-2:2023
ISO/IEC 27035-3:2020
ISO/IEC 27037:2012 §5.4.1
ISO/IEC 27040:2024 §10.6.7
ISO/IEC 27701
ISO/IEC 38505-1
ISO/IEC 38507:2022
ISO/IEC 42001
ISO/IEC 42005:2025
ISO/IEC 5259-2:2024
ISO/IEC 5259-3:2024
ISO/IEC 5259-4:2024
ISO/IEC 5259-5:2025
ISO/IEC 8183:2023
ISO/IEC/IEEE 42010:2022
Law No. 6698 (KVKK) Art. 12(5)
LGPD
MITRE ATLAS
NIS 2
NIST
NIST AI 100-2e2025
NIST AI RMF
NIST CSF
NIST IR 8011 Vol. 1
NIST Privacy Framework 1.0
NIST SP 800-111 §§3.1.1 and 3.2 (pre-boot authentication)
NIST SP 800-124 Rev. 2 §4.3.3 (remote wipe scope and its limits as a sole control)
NIST SP 800-53
NIST SP 800-53A Rev. 5
NIST SP 800-61 Rev. 3
NIST SP 800-88 Rev. 2
OECD AI Principles
OECD G20 Principles of Corporate Governance
Ontario FIPPA s. 40.1 (in force since 2025-07-01)
Ontario MFIPPA s. 30.1 (not yet in force; comes into force 2027-01-01)
Open Group TOGAF Standard
OWASP AI Exchange
OWASP LLM Top 10
OWASP SAMM
PIPEDA
PIPEDA Breach of Security Safeguards Regulations (successor Bill C-36/PPCDA proposed, not in force)
PIPL
Quebec Law 25
SANS CAISG v1.4
Singapore IMDA Model AI Governance Framework for Agentic AI (v1.5, 2026)
The Open Group TOGAF Standard
TIBER-EU
Treasury Board Directive on Automated Decision-Making / Voluntary Code of Conduct on Generative AI (AIDA lapsed)
Treasury Board Directive on Automated Decision-Making, section 6.1 (Algorithmic Impact Assessment; federal institutions subject to the Policy on Service and Digital)
UU PDP (Law No. 27 of 2022) Art. 46
WCO SAFE

Go deeper

The domains behind it

All leadership concerns